About CheckMySitesBot
If you found this page from a user-agent string in your access logs, this explains what visited you and why.
What it is
CheckMySitesBot fetches a page when somebody asks CheckMySites to audit it. Every request is triggered by a person entering a URL — there is no background crawling, no discovery crawl, and no scheduled sweep of the web.
In practice this means: if we visited you, either you audited your own site, or somebody else audited it. A single audit produces roughly 15 to 40 requests over a few seconds, then nothing.
Identifying it
Mozilla/5.0 (compatible; CheckMySitesBot/1.0; +https://checkmysites.com/bot)How it behaves
| Behaviour | Detail |
|---|---|
| Methods | GET and HEAD only. Never POST, PUT or DELETE. |
| robots.txt | Read and honoured before the audit runs. |
| Requests per audit | One for the page, one for robots.txt, one for the sitemap, plus up to 50 HEAD requests to sample links. |
| Concurrency | Link checks run five at a time, not all at once. |
| Download limit | 5MB per response, then the connection is closed. |
| Timeout | 15 seconds per request. |
| JavaScript | Not executed. We see what a non-rendering crawler sees, which is deliberate — it is what most AI crawlers see too. |
| Forms | Never submitted. Nothing is ever written to your site. |
| Authentication | Never attempted. We only fetch pages a logged-out visitor could reach. |
What it does not do
Our security checks are strictly passive — they read response headers, inspect your TLS certificate and look at what is already in the page. Specifically, we do not:
- Attempt any form of injection or exploitation
- Enumerate directories or guess file paths
- Scan ports
- Attempt to log in or bypass access controls
- Follow links to third-party sites beyond a single liveness check
An auditing tool has no business sending traffic a target would reasonably classify as an attack, even when the person who asked for the audit owns the site.
Blocking it
Add this to your robots.txt. We check it before every audit and will stop visiting:
User-agent: CheckMySitesBot
Disallow: /Anyone who then tries to audit your site sees a finding telling them robots.txt blocks the audit, rather than a report.
If it caused a problem
An audit is a handful of requests over a few seconds, so it is unlikely to be the cause of a load issue — but if you believe it was, email support@checkmysites.com with the timestamp and your domain and we will look into it and can block your domain at our end.
What we keep
The audit report itself — findings, scores and extracted metadata such as your title and headings — belongs to the person who ran it. We do not store your full page HTML, and any string matching the shape of a private API key is redacted before it enters a report, so a report can never become a second place a secret leaks.